Dan Rosenberg eaf06b241b Restrict unprivileged access to kernel syslog ... The kernel syslog contains debugging information that is often useful during exploitation of other vulnerabilities, such as kernel heap addresses. Rather than futilely attempt to sanitize hundreds (or thousands) of printk statements and simultaneously cripple useful debugging functionality, it is far simpler to create an option that prevents unprivileged users from reading the syslog. This patch, loosely based on grsecurity's GRKERNSEC_DMESG, creates the dmesg_restrict sysctl. When set to "0", the default, no restrictions are enforced. When set to "1", only users with CAP_SYS_ADMIN can read the kernel syslog via dmesg(8) or other mechanisms. [akpm@linux-foundation.org: explain the config option in kernel.txt] Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Acked-by: Ingo Molnar <mingo@elte.hu> Acked-by: Eugene Teo <eugeneteo@kernel.org> Acked-by: Kees Cook <kees.cook@canonical.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2010-11-12 07:55:32 -08:00
..
ABI	oom: document obsolete oom_adj tunable	2010-11-12 07:55:31 -08:00
accounting	delay-accounting: reimplement -c for getdelays.c to report information on a target command	2010-10-27 18:03:17 -07:00
acpi	ACPI: introduce module parameter acpi.aml_debug_output	2010-08-14 23:02:14 -04:00
aoe	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
arm	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2010-10-24 13:41:39 -07:00
auxdisplay
blackfin	Blackfin: document SPI CS limitations with CPHA=0	2010-08-06 12:55:52 -04:00
block	Merge branch 'v2.6.36-rc8' into for-2.6.37/barrier	2010-10-19 09:13:04 +02:00
blockdev	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
cdrom	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
cgroups	cgroup: add clone_children control file	2010-10-27 18:03:09 -07:00
connector
console
cpu-freq
cpuidle
cris
crypto
development-process	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
device-mapper	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
DocBook	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb	2010-10-29 11:49:38 -07:00
driver-model
dvb	[media] lmedm04: driver for DM04/QQBOX updated to version 1.60	2010-10-22 22:22:47 -02:00
early-userspace
fault-injection
fb	Merge branch 'viafb-next' of git://github.com/schandinat/linux-2.6	2010-10-27 19:02:41 -07:00
filesystems	locks: remove fl_copy_lock lock_manager operation	2010-10-31 06:35:15 -07:00
firmware_class	firmware: Update hotplug script	2010-08-05 13:53:34 -07:00
frv
hwmon	hwmon: (it87) Add support for the IT8721F/IT8758E	2010-10-28 20:31:51 +02:00
i2c	i2c-i801: Add PCI idents for Patsburg 'IDF' SMBus controllers	2010-10-31 21:07:00 +01:00
i2o
ia64	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
ide
infiniband	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
input	HID: ntrig: add documention	2010-08-30 15:25:18 +02:00
ioctl	Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6	2010-10-28 12:13:00 -07:00
isdn	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2010-08-04 15:31:02 -07:00
ja_JP	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
kbuild	Merge branch 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6	2010-10-28 16:18:59 -07:00
kdump
ko_KR	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
kvm	KVM: Document that KVM_GET_SUPPORTED_CPUID may return emulated values	2010-10-24 10:52:48 +02:00
laptops	thinkpad-acpi: untangle ACPI/vendor backlight selection	2010-08-16 11:54:50 -04:00
lguest	Merge branch 'v2.6.36-rc8' into for-2.6.37/barrier	2010-10-19 09:13:04 +02:00
m68k
make
mips
misc-devices	Documentation: short descriptions for bh1770glc and apds990x drivers	2010-10-26 16:52:14 -07:00
mmc	mmc: add erase, secure erase, trim and secure trim operations	2010-08-12 08:43:30 -07:00
mn10300
mtd	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
namespaces
netlabel
networking	phylib: make local function static	2010-10-24 15:07:11 -07:00
parisc
PCI
pcmcia	pcmcia: use autoconfiguration feature for ioports and iomem	2010-09-29 17:20:24 +02:00
power	PM: Introduce library for device-specific OPPs (v7)	2010-10-17 01:57:50 +02:00
powerpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6	2010-10-22 20:30:48 -07:00
pps
prctl
RCU	rcu: Add tracing data to support queueing models	2010-09-23 09:16:53 -07:00
s390	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
scheduler
scsi	[SCSI] megaraid_sas: Version and documentation update	2010-10-26 11:11:12 -05:00
serial	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
sh
sound	Merge branch 'topic/hda' into for-linus	2010-10-25 10:40:05 +02:00
sparc
spi
sysctl	Restrict unprivileged access to kernel syslog	2010-11-12 07:55:32 -08:00
telephony	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
thermal
timers	Documentation/timers/hpet_example.c: add supporting info for hpet_example	2010-10-26 16:52:11 -07:00
trace	tracing, vmscan: add trace events for LRU list shrinking	2010-10-26 16:52:07 -07:00
uml	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
usb	USB: teach "devices" file about Wireless and SuperSpeed USB	2010-10-22 10:21:40 -07:00
video4linux	[media] Support for Elgato Video Capture	2010-10-22 20:55:43 -02:00
vm	mm: highmem documentation	2010-10-26 16:52:08 -07:00
w1	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
watchdog
wimax
x86	Merge branch 'x86-irq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2010-10-22 08:54:21 -07:00
zh_CN	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
.gitignore
00-INDEX	mmc: add erase, secure erase, trim and secure trim operations	2010-08-12 08:43:30 -07:00
apparmor.txt
applying-patches.txt
atomic_ops.txt
bad_memory.txt
basic_profiling.txt
binfmt_misc.txt	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
braille-console.txt
bt8xxgpio.txt
btmrvl.txt
BUG-HUNTING
bus-virt-phys-mapping.txt
cachetlb.txt
Changes
circular-buffers.txt
coccinelle.txt	Coccinelle: Fix documentation	2010-10-28 00:32:23 +02:00
CodingStyle
cpu-hotplug.txt	documentation: fix erroneous email address.	2010-08-11 23:04:10 +09:30
cpu-load.txt
cputopology.txt	topology/sysfs: Provide book id and siblings attributes	2010-09-09 20:41:25 +02:00
credentials.txt
dcdbas.txt
debugging-modules.txt
debugging-via-ohci1394.txt
dell_rbu.txt
devices.txt	Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6	2010-10-28 09:35:11 -07:00
DMA-API-HOWTO.txt	Documentation: DMA-API-HOWTO.txt: rename ARCH_KMALLOC_MINALIGN to ARCH_DMA_MINALIGN	2010-08-14 11:56:46 -07:00
DMA-API.txt	dma-mapping: remove dma_is_consistent API	2010-08-11 08:59:21 -07:00
DMA-attributes.txt
DMA-ISA-LPC.txt
dmaengine.txt
dontdiff
dynamic-debug-howto.txt	Dynamic Debug: Introduce ddebug_query= boot parameter	2010-10-22 10:16:42 -07:00
edac.txt
eisa.txt
email-clients.txt
feature-removal-schedule.txt	Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6	2010-10-28 09:35:11 -07:00
flexible-arrays.txt
futex-requeue-pi.txt
gcov.txt
gpio.txt	gpio: doc updates	2010-09-09 18:57:24 -07:00
highuid.txt
HOWTO	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
hw_random.txt
init.txt
initrd.txt
intel_txt.txt	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
Intel-IOMMU.txt
io_ordering.txt
io-mapping.txt
iostats.txt
IPMI.txt
IRQ-affinity.txt
IRQ.txt
irqflags-tracing.txt
isapnp.txt
java.txt
kernel-doc-nano-HOWTO.txt	docbook: warn on unused doc entries	2010-09-11 16:49:21 -07:00
kernel-docs.txt	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
kernel-parameters.txt	Merge branch 'linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6	2010-10-28 11:59:52 -07:00
keys-request-key.txt
keys.txt
kmemcheck.txt
kmemleak.txt
kobject.txt
kprobes.txt	kprobes: Update document about irq disabled state in kprobe handler	2010-10-14 08:55:27 +02:00
kref.txt
ldm.txt	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
leds-class.txt
leds-lp3944.txt
local_ops.txt
lockdep-design.txt
lockstat.txt
logo.gif
logo.txt
magic-number.txt
Makefile
ManagementStyle
mca.txt
md.txt	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
memory-barriers.txt
memory-hotplug.txt
memory.txt
mono.txt
mutex-design.txt	mutex: Fix annotations to include it in kernel-locking docbook	2010-09-03 08:19:51 +02:00
nmi_watchdog.txt
nommu-mmap.txt
numastat.txt
oops-tracing.txt
padata.txt	Documentation/padata.txt: fix typos etc.	2010-08-11 08:59:18 -07:00
parport-lowlevel.txt
parport.txt
pi-futex.txt
pnp.txt
preempt-locking.txt
printk-formats.txt
prio_tree.txt
rbtree.txt
rfkill.txt
robust-futex-ABI.txt
robust-futexes.txt
rt-mutex-design.txt
rt-mutex.txt
rtc.txt
SAK.txt
SecurityBugs
SELinux.txt
serial-console.txt
sgi-ioc4.txt
sgi-visws.txt
SM501.txt
Smack.txt
sparse.txt
spinlocks.txt
stable_api_nonsense.txt
stable_kernel_rules.txt
SubmitChecklist
SubmittingDrivers	Documentation: update broken web addresses.	2010-08-04 15:21:40 +02:00
SubmittingPatches	SubmittingPatches: add more about patch descriptions	2010-08-09 20:45:05 -07:00
svga.txt
sysfs-rules.txt
sysrq.txt	documentation: update sysrq.txt magic sysrq keys	2010-10-26 17:32:41 -07:00
tomoyo.txt
unaligned-memory-access.txt
unicode.txt
unshare.txt
VGA-softcursor.txt
vgaarbiter.txt
video-output.txt
volatile-considered-harmful.txt
workqueue.txt	workqueue: add and use WQ_MEM_RECLAIM flag	2010-10-11 15:20:26 +02:00
zorro.txt